Thursday night, October 29, somebody robbed the biggest cryptocurrency exchange on the planet of roughly $6.3 billion — in about twenty minutes. It is the largest crypto theft in history, roughly four times the size of the Bybit hack that held the record until now, and analysts at Elliptic believe it may be the largest theft of any kind ever recorded.
And it happened on the same week the stock market decided that AI’s biggest spenders might not be worth their price tags.
If you hold crypto — or you just watch the space — this week deserves your full attention. Not because of the price action, which was ugly but familiar. Because of what it revealed about where the real risks live.
What Actually Happened at Binance
Shortly after 20:00 UTC on Thursday, Binance’s hot wallets — the internet-connected wallets exchanges use to process withdrawals — started draining. Bitcoin, ether, USDT, USDC, and smaller tokens across ten or eleven blockchains moved into attacker-controlled addresses in a burst that lasted roughly twenty minutes. One transaction moved 167,464 ETH. Another moved 18,270 BTC. On-chain data later showed those coins split into 19 fresh wallets — seventeen of them holding exactly 1,000 BTC each — that haven’t moved since.
Binance’s first investigation pointed at a compromised DevOps engineer’s laptop: the attacker gained access to a service container and submitted unauthorized withdrawal requests through the exchange’s own internal systems. Separately, the attacker used an Ethereum feature called EIP-7702 to trick one wallet — “Binance 14,” which appears in Binance’s own October 1 proof-of-reserves report — into signing over control of itself. Binance says it has found no evidence that any wallet private keys were leaked, and that additional exploit points were discovered. Translation: this wasn’t someone cracking the blockchain. It was someone cracking the company’s plumbing. (If that phrasing sounds familiar, it’s the exact lesson from the NEAR Intents exploit we covered earlier this month. The hackers still haven’t broken the blockchain. They keep breaking the plumbing.)
Within about an hour, the industry fought back. Tether froze more than 1.567 billion USDT. Circle froze around $823 million in USDC. Ripple froze about $200 million. World Liberty Financial froze $27 million of its USD1 stablecoin. Total frozen: roughly $3 billion — nearly half the haul, per Elliptic’s count. The attacker had already started swapping the rest into ether and bitcoin, which no issuer can freeze.
Binance paused withdrawals, kept deposits open, and promised to cover every loss. Co-CEO Richard Teng said the exchange arranged more than $6.34 billion in company resources to restore customer balances one-for-one, drawing on its corporate treasury and the SAFU emergency fund (roughly $1 billion in bitcoin). “User funds are safe,” he said, and so did co-CEO Yi He and founder CZ. Withdrawals were expected to resume roughly 45 to 48 hours after the pause — by Sunday morning. The next proof-of-reserves snapshot, due November 1, will show whether the stolen assets have actually been replaced.
And the attribution? Chainalysis, TRM Labs, and Elliptic all linked the operation to North Korea’s TraderTraitor group — associated with the Lazarus Group — with high confidence. Elliptic found that some of the stolen Binance funds landed at the same Ethereum address as proceeds from a suspected DPRK exploit of the Bitget exchange. So: the two biggest crypto thefts in history, and quite possibly the biggest theft of all time, were both run by the same state-sponsored crew.
Oh, and this was the second hack that day — prediction market Polymarket disclosed that one of its third-party providers had been breached too, though on a far smaller scale.
What the Market Did: $1.5 Billion in Leverage, Gone
The market did not wait for explanations. BNB fell 8.7% within an hour. Bitcoin slid below $77,000 to a low of $76,443 — a six-week low that landed within $30 of its 200-day exponential moving average at $76,473, where buyers finally stepped in. Ether dropped more than 3% into the low $2,180s. Bitcoin clawed back toward $78,000 within a day.
But the real carnage was in leverage. About $1.55 billion in positions were liquidated in 24 hours across 239,610 traders, per CoinGlass — and 83.6% of it, roughly $1.29 billion, was long bets. Bitcoin positions accounted for $501.6 million of the wreckage, ether another $360.6 million. Binance itself handled nearly half of all the liquidations, including the single largest: an $11.09 million BTCUSDT long closed at $79,254.71. The Crypto Fear & Greed Index dropped from 51 to 30 — straight into “fear” — in a day.
Meanwhile, the big money was buying insurance before the news was even public. On Paradigm, the institutional options network, roughly $590 million in notional bitcoin options blocks traded in the eight hours after the hack — lopsidedly bearish, concentrated in $74,000 to $78,000 puts expiring this week and in mid-November. The very first big trade hit at 20:38 UTC, about fifteen minutes after the first outflows and before Binance had said a word.
Read that again. Smart money hedged the crash during the crash, in strikes right under the spot price. Retail longs got liquidated. Same market, same event, opposite sides of the trade — the difference was leverage and speed, not information.
Meanwhile, Wall Street Was Getting Thrashed Too
Here’s what makes this week genuinely unusual: crypto wasn’t bleeding alone.
On the same Thursday, Alphabet suffered a record 13% single-day collapse after missing third-quarter expectations — EPS of $2.12 versus $2.94 expected — while reporting negative $9.07 billion in free cash flow and maintaining a full-year AI capital expenditure guide of $195–205 billion. The fall wiped roughly $500 billion off its market cap. The Nasdaq dropped 1.4%, the S&P 500 and Dow each fell 0.3%, and communication services cratered 6.6% — its worst day since February 2022.
Then Friday morning, Amazon signaled its AI spending boom is far from over — shares down 7.2% premarket — and Intel tanked 25% after warning it will burn cash this year. Nasdaq futures fell more than 2%.
The story in equities is simple: the market stopped paying for AI promises and started charging for AI cash burn. Microsoft — which beat estimates with 48% Azure growth and positive $18.6 billion in free cash flow — was fine. Alphabet, Amazon, and Intel got punished. As one analyst put it, investors are distinguishing between companies spending heavily on AI and companies generating cash.
Sound familiar? It should. That’s the exact same repricing crypto went through after the last cycle: stop funding narratives, start demanding treasuries. The two markets are reacting to the same underlying force — a global risk-off repricing of “growth at any cost” — which is why, for all the talk of crypto being a separate asset class, Bitcoin and the Nasdaq keep bleeding on the same days.
The Mindset Shift: Five Lessons From the Week
1. Custody risk is the risk. Most people in crypto spend their energy worrying about which coin goes up. This week proved, again, that the more important question is who holds your coins. A withdrawal pause means your capital is trapped no matter what the chart does. Keep only what you’re actively trading on exchanges; everything else belongs in self-custody. Size your exchange exposure like it’s already gone.
2. Leverage turns bad news into catastrophe. The hack was bad. But $1.5 billion in liquidations — overwhelmingly longs, overwhelmingly at Binance — is what turned a 4% spot dip into a bloodbath. Every one of those traders was wiped out not by the hack but by their own position sizing. If you’re holding leveraged longs into a weekend with withdrawals paused on the biggest exchange on earth, the market isn’t your problem. You are.
3. “User funds are safe” is a balance-sheet statement, not a technical one. Binance could credibly promise to make everyone whole because it has $6.34 billion in company resources plus a billion-dollar SAFU fund. Most exchanges cannot. When you trust an exchange, you’re not trusting its security team — you’re trusting its treasury. Ask which one you’re actually trusting.
4. The “uncorrelated asset” story keeps dying. Every time crypto people claim Bitcoin trades on its own logic, some week arrives where AI earnings and a $6.3 billion heist happen together and everything sells off in unison. In a genuine risk-off moment, correlations go to one. Build your portfolio assuming that — position sizing that only works if crypto zigs while stocks zag is a fantasy.
5. State-sponsored heists are a business model now. DPRK has now run the two largest crypto thefts in history (Bybit, then Binance — possibly the largest thefts of any kind, ever), and the laundering infrastructure keeps getting reused. This isn’t going away. It means exchange security, proof-of-reserves transparency, and freeze coordination between issuers will matter more, not less — and it means every big holder should assume sophisticated actors are continuously probing the plumbing.
What to Watch Next
Three things decide whether this becomes a footnote or a chapter. First, the November 1 proof-of-reserves snapshot — if Binance has genuinely replaced the stolen assets one-for-one, the “user funds are safe” claim holds up. If the numbers wobble, trust erodes fast. Second, withdrawal resumption — a clean reopening kills the bank-run narrative; a delay extends it. Third, the frozen $3 billion — if law enforcement and issuers recover a meaningful share, it sets a precedent that $6-billion-scale thefts can’t actually be cashed out, which changes the economics of the next attempt.
The week reminded everyone of something crypto investors keep having to relearn: in this market, the catastrophic risks are almost never the ones on the chart. They’re the ones in the plumbing — an engineer’s laptop, a signing standard, a margin call, a cash-burn guidance number. Research the upside. But respect the downside, because this week it was worth $6.3 billion.
Sources: CoinDesk, Elliptic, TRM Labs, Chainalysis, CoinGlass, CoinGecko, CNBC, Reuters, Invezz, TradingView. Numbers reflect reporting as of October 30, 2026 and may be revised as investigations continue.